Zero trust is a security approach that gives no access by default, whatever the network location: every request is verified, access is limited to what is needed, and you plan as if attackers are already inside. Start with identity, MFA and device checks for your most important apps, not with new network hardware.
Key takeaways
- Zero trust is a strategy, not a product you buy.
- Microsoft states three principles: verify explicitly, use least privilege access, assume breach.
- NIST SP 800-207 frames it as moving defenses from fixed network perimeters to users, assets and resources.
- The first practical steps are identity, MFA and least privilege on the systems that hold your data.
What is zero trust?
Zero trust is the idea that "there is no implicit trust granted to assets or user accounts," in the words of NIST SP 800-207, published in August 2020. The document describes an evolving set of cybersecurity paradigms that move defenses toward users, assets and resources, driven by remote work, bring your own device and cloud assets.
Microsoft puts it as "never trust, always verify," and says verification is continuous, not a one time check at sign-in.
What are the core principles?
There are three, as Microsoft's overview lists them.
- Verify explicitly: authenticate and authorize every request using all available signals.
- Use least privilege access: give users and workloads only the access they need, for the shortest time required.
- Assume breach: design controls to limit damage and speed detection, because attackers might already be inside.
Why does the old perimeter model fall short?
Perimeter models assume that things inside the network are safer than things outside. Microsoft's overview says that is not enough today because modern attacks use identity compromise, phishing and session hijacking, and do not depend on network location.
How do I start with zero trust?
Start small and in this order. Microsoft notes that adoption is gradual and long term, and every organization begins from a different place.
- Inventory what matters: your top five apps, data stores and cloud accounts.
- Put those behind SSO with MFA, and prefer phishing-resistant methods for admins. See best SSO and MFA options for a small company.
- Remove standing admin rights. Use temporary roles. Our PAM tool guide shows the options.
- Add device checks and logging, then widen to the next set of apps.
CISA publishes a Zero Trust Maturity Model, version 2.0 as of the page we read. It describes traditional, initial, advanced and optimal stages within each pillar, which gives you a way to measure progress.
Frequently asked questions
Is zero trust a product?
No. NIST describes it as a set of paradigms, and Microsoft calls it a security approach. Products help you apply it, but none gives it to you alone.
Does zero trust mean trusting nobody at work?
No. It means access depends on verified identity, device and context, not on being on the office network.
Do small companies need zero trust?
The principles apply at any size. A small team can apply them with SSO, MFA and least privilege, which cost little.
How long does zero trust take?
Microsoft calls it a gradual, long term effort. Plan in stages and judge each by the systems protected.
Sources
- NIST SP 800-207, Zero Trust Architecture
- Microsoft, Zero Trust as a security foundation
- CISA Zero Trust Maturity Model
Last reviewed: 19 October 2026.
